Designing an IRB for Security Research

1. Overview

In 2012, an anonymous researcher scanned the entire IPv4 address space using a botnet they built by compromising thousands of insecure home routers with default passwords. The project, known as the Internet Census 2012, produced fascinating data about global internet usage. But it also crossed serious ethical and legal boundaries — no one gave consent, and the researcher effectively took control of real devices owned by everyday users.

In this activity, you’ll step into the role of an Institutional Review Board (IRB). Your job is to review real or realistic research proposals that raise ethical concerns. You’ll need to evaluate the risks and benefits, think about informed consent and user harm, and decide whether or not the study should go forward.

---

2. Learning Objectives

By the end of this session, you should be able to:

• Recognize common ethical dilemmas in security research
• Apply key ethical principles (respect for persons, beneficence, and justice)
• Think critically about the tradeoffs between scientific value and user risk
• Develop a clear and defensible decision about whether a study should be approved

---

3. Activity

Step 1: Read the Case Studies

Each group will receive a one-page research proposal. These are based on real-world or plausible scenarios. Example cases include:

• IPv4 scanning via home routers (Internet Census 2012)
• Facebook’s emotional contagion study
• The Encore Internet censorship measurement tool

Read your assigned case carefully and prepare to act as the IRB.

Step 2: IRB Deliberation (20–30 minutes)

As an IRB panel, your group will:

• Identify the main ethical risks in the study
• Consider whether consent is required or if it can be waived
• Propose changes to make the study more ethically sound
• Decide: approve, conditionally approve, or reject the proposal
• Write down your reasoning in bullet points

Step 3 (Optional): Researcher Rebuttal

If there’s time, switch roles with another group. Take their case and defend the research as if you were the original researchers appealing the IRB’s decision. Prepare a short statement to present.

---

4. Discussion

We’ll come back together as a class to compare decisions and talk through the hard calls. Some questions to think about:

• Would your view change if the data was never published?
• Does doing nothing sometimes cause more harm than taking ethical risks?
• What does meaningful consent look like in adversarial research?
• How would a university IRB, journal editor, or funding agency see this?

Be ready to share your group’s decision and the reasoning behind it.